@prenta/core 0.118.0

package/dist/middleware.js

@@ -0,0 +1,159 @@
+import { verifySession } from './auth/session.js';
+import { isIpAllowed } from './security/ip-allowlist.js';
+import { getClientIp, isResolvedIp } from './security/client-ip.js';
+// Accept the full `PrentaCMSConfig` directly (type-only import — erased at
+// build time) so consumers can pass their `prenta.config` export without an
+// `as unknown as` cast, while still tolerating the looser shape used in tests.
+export function createCMSMiddleware(cmsConfig) {
+    const adminPath = cmsConfig.admin?.path ?? '/admin';
+    // Split-login installs serve the auth screens on their own mount; it gets
+    // the same guards (IP allowlist, CMS_SECRET check) as the admin itself.
+    const loginPath = cmsConfig.admin?.loginPath;
+    const ipAllowlist = cmsConfig.admin?.ipAllowlist;
+    const secret = process.env.CMS_SECRET ?? '';
+    return async function cmsMiddleware(request) {
+        const url = new URL(request.url);
+        const isAdminRoute = pathMatchesPrefix(url.pathname, adminPath) ||
+            (loginPath ? pathMatchesPrefix(url.pathname, loginPath) : false);
+        const isCMSApiRoute = pathMatchesPrefix(url.pathname, '/api/cms');
+        if (!isAdminRoute && !isCMSApiRoute) {
+            return null;
+        }
+        // Setup wizard endpoints must be reachable when there's no admin user yet
+        // — they're disabled by the wizard handler itself once the first admin
+        // exists. Both the UI route and the API route need to bypass IP/session
+        // checks during initial install.
+        const isSetupRoute = url.pathname === `${adminPath}/setup` ||
+            url.pathname.startsWith(`${adminPath}/setup/`) ||
+            (loginPath
+                ? url.pathname === `${loginPath}/setup` || url.pathname.startsWith(`${loginPath}/setup/`)
+                : false) ||
+            url.pathname.startsWith('/api/cms/setup');
+        if (isSetupRoute) {
+            return null;
+        }
+        // IP allowlist check for admin AND admin-API routes. The original code
+        // only checked admin UI routes, leaving the API endpoints reachable from
+        // any IP — which defeats the entire point of an allowlist for an
+        // attacker who already has a stolen cookie.
+        //
+        // NOTE: this middleware runs on the edge and can only see the CONFIG half
+        // of the allowlist. The database-stored Settings → Security allowlist is
+        // enforced (as a union with these config ranges) inside the API handler —
+        // see the allowlist guard in `api/handler-factory.ts`.
+        if (ipAllowlist && ipAllowlist.length > 0 && (isAdminRoute || isCMSApiRoute)) {
+            const clientIp = getClientIp(request);
+            // 'unknown' is never on an allowlist — fail closed when we cannot
+            // resolve a trustworthy source IP.
+            if (!isResolvedIp(clientIp) || !isIpAllowed(clientIp, ipAllowlist)) {
+                return new Response('Forbidden', { status: 403 });
+            }
+        }
+        // CMS_SECRET is mandatory: it signs session JWTs, so the admin (including
+        // the setup wizard, which auto-logs-in the new admin) cannot function
+        // without it. Rather than a bare 500, return an actionable page that tells
+        // the operator exactly what to set. The setup *API* route is already
+        // bypassed above, so this only guards the admin UI.
+        if (isAdminRoute && !secret) {
+            return configMissingResponse();
+        }
+        // Session verification for admin routes (not API routes — those handle their own auth)
+        if (isAdminRoute && secret) {
+            const cookie = parseCookie(request.headers.get('cookie') ?? '');
+            const token = cookie['prenta_session'];
+            if (!token) {
+                return null;
+            }
+            try {
+                await verifySession(token, { secret });
+            }
+            catch {
+                return new Response(null, {
+                    status: 302,
+                    headers: {
+                        // Expired/invalid session: send the user where they can sign in
+                        // again — the dedicated login mount on split-login installs.
+                        Location: loginPath ?? adminPath,
+                        'Set-Cookie': 'prenta_session=; Path=/; HttpOnly; Max-Age=0',
+                    },
+                });
+            }
+        }
+        return null;
+    };
+}
+/**
+ * Actionable error page shown when the admin UI is requested but `CMS_SECRET`
+ * is not configured. Self-contained HTML (no external assets, no theme access)
+ * because it renders before the admin shell can load. Deliberately leaks no
+ * secret values — only the variable name and remediation steps.
+ */
+function configMissingResponse() {
+    const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Prenta CMS — Configuration required</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center;
+    font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+    background: #0b0d12; color: #e6e8eb; line-height: 1.5; padding: 24px; }
+  .card { max-width: 560px; width: 100%; background: #151922; border: 1px solid #262c38;
+    border-radius: 12px; padding: 28px 32px; }
+  h1 { font-size: 1.25rem; margin: 0 0 8px; font-weight: 500; }
+  p { margin: 0 0 12px; color: #aab2bd; }
+  code { background: #0b0d12; border: 1px solid #262c38; border-radius: 6px;
+    padding: 2px 6px; font-size: 0.9em; }
+  pre { background: #0b0d12; border: 1px solid #262c38; border-radius: 8px;
+    padding: 12px 14px; overflow-x: auto; font-size: 0.85rem; color: #e6e8eb; }
+  ol { margin: 0 0 4px; padding-left: 20px; color: #aab2bd; }
+  li { margin-bottom: 6px; }
+</style>
+</head>
+<body>
+  <main class="card">
+    <h1>Prenta CMS isn't configured yet</h1>
+    <p>The <code>CMS_SECRET</code> environment variable is missing or empty. It's
+    required to sign admin sessions, so the admin panel can't start without it.</p>
+    <ol>
+      <li>Generate a secret (at least 32 characters):
+        <pre>node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"</pre>
+      </li>
+      <li>Set <code>CMS_SECRET</code> to that value in your environment (or your
+      host's environment variables), then restart / redeploy.</li>
+    </ol>
+    <p>This page is only visible to operators — visitors never see it.</p>
+  </main>
+</body>
+</html>`;
+    return new Response(html, {
+        status: 503,
+        headers: {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': 'no-store',
+        },
+    });
+}
+/**
+ * Match a pathname against a route prefix on a path-segment boundary, so the
+ * admin guard for `/admin` does not also capture sibling public routes like
+ * `/administrators` or `/admin-news`. A path matches when it equals the prefix
+ * exactly or continues with a `/`.
+ */
+function pathMatchesPrefix(pathname, prefix) {
+    const normalized = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+    return pathname === normalized || pathname.startsWith(`${normalized}/`);
+}
+function parseCookie(cookieHeader) {
+    const cookies = {};
+    for (const pair of cookieHeader.split(';')) {
+        const [key, ...rest] = pair.split('=');
+        if (key) {
+            cookies[key.trim()] = rest.join('=').trim();
+        }
+    }
+    return cookies;
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAYnE,2EAA2E;AAC3E,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,SAAoD;IACtF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,CAAA;IACnD,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,CAAA;IAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAA;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAA;IAE3C,OAAO,KAAK,UAAU,aAAa,CAAC,OAAgB;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAEhC,MAAM,YAAY,GAChB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC1C,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAClE,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAEjE,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,GAAG,SAAS,QAAQ;YACrC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,SAAS,CAAC;YAC9C,CAAC,SAAS;gBACR,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,SAAS,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,SAAS,CAAC;gBACzF,CAAC,CAAC,KAAK,CAAC;YACV,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;QAC3C,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,iEAAiE;QACjE,4CAA4C;QAC5C,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,uDAAuD;QACvD,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,EAAE,CAAC;YAC7E,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;YACrC,kEAAkE;YAClE,mCAAmC;YACnC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;gBACnE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,qEAAqE;QACrE,oDAAoD;QACpD,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,qBAAqB,EAAE,CAAA;QAChC,CAAC;QAED,uFAAuF;QACvF,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;YAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,gEAAgE;wBAChE,6DAA6D;wBAC7D,QAAQ,EAAE,SAAS,IAAI,SAAS;wBAChC,YAAY,EAAE,8CAA8C;qBAC7D;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsCP,CAAA;IACN,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACtE,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,YAAoB;IACvC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/multisite/index.d.ts

@@ -0,0 +1,20 @@
+export interface SiteConfig {
+    id: string;
+    domain: string;
+    name: string;
+    configOverrides?: Record<string, unknown>;
+    isDefault: boolean;
+}
+export interface SiteContext {
+    currentSite: SiteConfig;
+    allSites: SiteConfig[];
+}
+/** Resolve the current site from a request hostname. */
+export declare function resolveSite(hostname: string, _db: unknown): Promise<SiteConfig | null>;
+/** Get the default site configuration. */
+export declare function getDefaultSite(_db: unknown): Promise<SiteConfig | null>;
+/** List all configured sites. */
+export declare function listSites(_db: unknown): Promise<SiteConfig[]>;
+/** Create a site context from a request, falling back to the default site. */
+export declare function createSiteContext(hostname: string, _db: unknown): Promise<SiteContext>;
+//# sourceMappingURL=index.d.ts.map

package/dist/multisite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/multisite/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,UAAU,CAAA;IACvB,QAAQ,EAAE,UAAU,EAAE,CAAA;CACvB;AAED,wDAAwD;AACxD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAI5F;AAED,0CAA0C;AAC1C,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE7E;AAED,iCAAiC;AACjC,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEnE;AAED,8EAA8E;AAC9E,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ5F"}

package/dist/multisite/index.js

@@ -0,0 +1,26 @@
+/** Resolve the current site from a request hostname. */
+export async function resolveSite(hostname, _db) {
+    void hostname;
+    // TODO: query prenta_sites by domain
+    throw new Error('Not implemented');
+}
+/** Get the default site configuration. */
+export async function getDefaultSite(_db) {
+    throw new Error('Not implemented');
+}
+/** List all configured sites. */
+export async function listSites(_db) {
+    throw new Error('Not implemented');
+}
+/** Create a site context from a request, falling back to the default site. */
+export async function createSiteContext(hostname, _db) {
+    const currentSite = await resolveSite(hostname, _db);
+    if (!currentSite) {
+        const defaultSite = await getDefaultSite(_db);
+        if (!defaultSite)
+            throw new Error('No site configured');
+        return { currentSite: defaultSite, allSites: await listSites(_db) };
+    }
+    return { currentSite, allSites: await listSites(_db) };
+}
+//# sourceMappingURL=index.js.map

package/dist/multisite/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/multisite/index.ts"],"names":[],"mappings":"AAaA,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,GAAY;IAC9D,KAAK,QAAQ,CAAA;IACb,qCAAqC;IACrC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACpC,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY;IAC/C,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACpC,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAY;IAC1C,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACpC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,GAAY;IACpE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACvD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;IACrE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;AACxD,CAAC"}

package/dist/navigation/unresolved-targets.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Soft validation for navigation trees: warn when an internal URL does not
+ * resolve to a known published page (or redirect terminal). Non-blocking —
+ * menus may still save with unresolved targets.
+ */
+import { type RedirectRecord } from '../redirects/graph.js';
+export interface UnresolvedNavTarget {
+    /** JSON-path style locator, e.g. `items[0].children[1]`. */
+    itemPath: string;
+    label: string;
+    url: string;
+    /** Normalized path used for matching. */
+    normalizedPath: string;
+}
+export interface CollectUnresolvedNavTargetsOptions {
+    /** Absolute site origin used to treat same-host absolute URLs as internal. */
+    siteUrl?: string;
+    /** Published (and other known) public paths, already normalized preferred. */
+    knownPaths: Iterable<string>;
+    /** Enabled redirect rules — a target that chains to a known path is OK. */
+    redirectRules?: RedirectRecord[];
+}
+/**
+ * Build a normalized published-path set from audit-style entity URLs.
+ */
+export declare function publishedPathsFromUrls(urls: Iterable<string>, siteUrl?: string): Set<string>;
+/**
+ * Walk a nav items tree and return internal targets that do not resolve to a
+ * known published path (directly or via redirect). External / placeholder
+ * URLs are skipped — structural validate handles `#`/empty separately.
+ */
+export declare function collectUnresolvedNavTargets(items: unknown, options: CollectUnresolvedNavTargetsOptions): UnresolvedNavTarget[];
+/** Human-readable soft warnings for MCP / admin banners. */
+export declare function formatUnresolvedNavWarnings(targets: UnresolvedNavTarget[]): string[];
+//# sourceMappingURL=unresolved-targets.d.ts.map

package/dist/navigation/unresolved-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unresolved-targets.d.ts","sourceRoot":"","sources":["../../src/navigation/unresolved-targets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAA;AAE9B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kCAAkC;IACjD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;CACjC;AA2BD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,SAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAiBxF;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,kCAAkC,GAC1C,mBAAmB,EAAE,CA0CvB;AAED,4DAA4D;AAC5D,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAKpF"}

package/dist/navigation/unresolved-targets.js

@@ -0,0 +1,109 @@
+/**
+ * Soft validation for navigation trees: warn when an internal URL does not
+ * resolve to a known published page (or redirect terminal). Non-blocking —
+ * menus may still save with unresolved targets.
+ */
+import { buildEdgeMap, normalizeRedirectPath, resolveChain, } from '../redirects/graph.js';
+function normalizeInternalPath(path, siteUrl) {
+    const trimmed = path.trim();
+    if (!trimmed ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('mailto:') ||
+        trimmed.startsWith('tel:') ||
+        trimmed.startsWith('javascript:')) {
+        return null;
+    }
+    if (/^https?:\/\//i.test(trimmed)) {
+        const base = siteUrl.replace(/\/+$/, '').toLowerCase();
+        if (!base || !trimmed.toLowerCase().startsWith(base))
+            return null;
+        return normalizeRedirectPath(trimmed.slice(base.length) || '/');
+    }
+    // Protocol-relative or other schemes → not an internal CMS path.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(trimmed))
+        return null;
+    return normalizeRedirectPath(trimmed);
+}
+function isObj(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/**
+ * Build a normalized published-path set from audit-style entity URLs.
+ */
+export function publishedPathsFromUrls(urls, siteUrl = '') {
+    const known = new Set();
+    const base = siteUrl.replace(/\/+$/, '');
+    for (const raw of urls) {
+        if (typeof raw !== 'string' || !raw.trim())
+            continue;
+        const asInternal = normalizeInternalPath(raw, base);
+        if (asInternal) {
+            known.add(asInternal);
+            continue;
+        }
+        // Entity URLs are usually site-relative (`/about`); keep those even when
+        // `siteUrl` is unset so absolute external URLs are never treated as paths.
+        if (raw.trim().startsWith('/')) {
+            known.add(normalizeRedirectPath(raw));
+        }
+    }
+    return known;
+}
+/**
+ * Walk a nav items tree and return internal targets that do not resolve to a
+ * known published path (directly or via redirect). External / placeholder
+ * URLs are skipped — structural validate handles `#`/empty separately.
+ */
+export function collectUnresolvedNavTargets(items, options) {
+    if (!Array.isArray(items))
+        return [];
+    const siteUrl = (options.siteUrl ?? '').replace(/\/+$/, '');
+    const knownPaths = new Set();
+    for (const p of options.knownPaths) {
+        if (typeof p !== 'string' || !p.trim())
+            continue;
+        knownPaths.add(normalizeRedirectPath(p));
+    }
+    const edgeMap = buildEdgeMap(options.redirectRules ?? []);
+    const pathExists = (path) => {
+        if (knownPaths.has(path))
+            return true;
+        const resolved = resolveChain(edgeMap, path);
+        if (resolved.loop)
+            return false;
+        return knownPaths.has(resolved.terminal);
+    };
+    const out = [];
+    const walk = (list, path) => {
+        if (!Array.isArray(list))
+            return;
+        list.forEach((raw, i) => {
+            const here = `${path}[${i}]`;
+            if (!isObj(raw))
+                return;
+            const url = typeof raw.url === 'string' ? raw.url : '';
+            const label = typeof raw.label === 'string' ? raw.label : '';
+            const normalized = normalizeInternalPath(url, siteUrl);
+            if (normalized && !pathExists(normalized)) {
+                out.push({
+                    itemPath: here,
+                    label,
+                    url,
+                    normalizedPath: normalized,
+                });
+            }
+            if (raw.children !== undefined)
+                walk(raw.children, `${here}.children`);
+        });
+    };
+    walk(items, 'items');
+    return out;
+}
+/** Human-readable soft warnings for MCP / admin banners. */
+export function formatUnresolvedNavWarnings(targets) {
+    return targets.map((t) => {
+        const name = t.label.trim() || '(untitled)';
+        return `${t.itemPath}: "${name}" points to "${t.url}" which has no published document (or matching redirect).`;
+    });
+}
+//# sourceMappingURL=unresolved-targets.js.map

package/dist/navigation/unresolved-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unresolved-targets.js","sourceRoot":"","sources":["../../src/navigation/unresolved-targets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,YAAY,GAEb,MAAM,uBAAuB,CAAA;AAoB9B,SAAS,qBAAqB,CAAC,IAAY,EAAE,OAAe;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IACE,CAAC,OAAO;QACR,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAC7B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EACjC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACjE,OAAO,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,iEAAiE;IACjE,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAsB,EAAE,OAAO,GAAG,EAAE;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,SAAQ;QACpD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACnD,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAc,EACd,OAA2C;IAE3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAEpC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAQ;QAChD,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE;QAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,QAAQ,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QAC/B,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1C,CAAC,CAAA;IAED,MAAM,GAAG,GAA0B,EAAE,CAAA;IAErC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAY,EAAE,EAAE;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAM;QAChC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,OAAM;YACvB,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YACtD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;YAC5D,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YACtD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC;oBACP,QAAQ,EAAE,IAAI;oBACd,KAAK;oBACL,GAAG;oBACH,cAAc,EAAE,UAAU;iBAC3B,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,CAAC,CAAA;QACxE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACpB,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,2BAA2B,CAAC,OAA8B;IACxE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,YAAY,CAAA;QAC3C,OAAO,GAAG,CAAC,CAAC,QAAQ,MAAM,IAAI,gBAAgB,CAAC,CAAC,GAAG,2DAA2D,CAAA;IAChH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/next/preview.d.ts

@@ -0,0 +1,10 @@
+export interface EnableDraftOptions {
+    secret: string;
+    db: unknown;
+}
+export declare function validatePreviewRequest(request: Request, options: EnableDraftOptions): Promise<{
+    valid: boolean;
+    collection?: string;
+    documentId?: string;
+}>;
+//# sourceMappingURL=preview.d.ts.map

package/dist/next/preview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../src/next/preview.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,OAAO,CAAA;CACZ;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvE"}

package/dist/next/preview.js

@@ -0,0 +1,17 @@
+import { createPreviewAdapter } from '../preview/index.js';
+export async function validatePreviewRequest(request, options) {
+    const url = new URL(request.url);
+    const token = url.searchParams.get('token');
+    if (!token)
+        return { valid: false };
+    const preview = createPreviewAdapter(options.secret, options.db);
+    const session = await preview.validatePreviewToken(token);
+    if (!session)
+        return { valid: false };
+    return {
+        valid: true,
+        collection: session.collection,
+        documentId: session.documentId,
+    };
+}
+//# sourceMappingURL=preview.js.map

package/dist/next/preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../src/next/preview.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAO1D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,OAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAEnC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAErC,OAAO;QACL,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAA;AACH,CAAC"}

package/dist/next/script-tags.d.ts

@@ -0,0 +1,15 @@
+import { type ReactElement } from 'react';
+/**
+ * Render a stored script-tag snippet as real `<script>` / `<noscript>` nodes.
+ *
+ * Wrapping snippets in `<div dangerouslySetInnerHTML>` prevents inline scripts
+ * from executing — browsers ignore `<script>` tags inserted via innerHTML on
+ * non-script parents. This helper preserves pass-through fidelity for GTM and
+ * other third-party embeds.
+ */
+export declare function scriptTagCodeToElements(code: string, keyPrefix: string): ReactElement[];
+export declare function ScriptTagGroup({ codes, idPrefix }: {
+    codes: string[];
+    idPrefix: string;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=script-tags.d.ts.map

package/dist/next/script-tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-tags.d.ts","sourceRoot":"","sources":["../../src/next/script-tags.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,OAAO,CAAA;AAEnD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,EAAE,CAqEvF;AAMD,wBAAgB,cAAc,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,2CAMxF"}

package/dist/next/script-tags.js

@@ -0,0 +1,58 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { Fragment } from 'react';
+/**
+ * Render a stored script-tag snippet as real `<script>` / `<noscript>` nodes.
+ *
+ * Wrapping snippets in `<div dangerouslySetInnerHTML>` prevents inline scripts
+ * from executing — browsers ignore `<script>` tags inserted via innerHTML on
+ * non-script parents. This helper preserves pass-through fidelity for GTM and
+ * other third-party embeds.
+ */
+export function scriptTagCodeToElements(code, keyPrefix) {
+    const trimmed = code.trim();
+    if (!trimmed)
+        return [];
+    const elements = [];
+    let index = 0;
+    let lastIndex = 0;
+    const tokenRe = /<script(\s[^>]*)?>([\s\S]*?)<\/script>|<noscript>([\s\S]*?)<\/noscript>/gi;
+    let match;
+    while ((match = tokenRe.exec(trimmed)) !== null) {
+        if (match.index > lastIndex) {
+            const html = trimmed.slice(lastIndex, match.index).trim();
+            if (html)
+                pushHtmlFragment(elements, `${keyPrefix}-html-${index++}`, html);
+        }
+        if (match[0].toLowerCase().startsWith('<noscript')) {
+            elements.push(_jsx("noscript", { dangerouslySetInnerHTML: { __html: match[3] ?? '' }, suppressHydrationWarning: true }, `${keyPrefix}-ns-${index++}`));
+        }
+        else {
+            const attrs = match[1] ?? '';
+            const content = match[2] ?? '';
+            const src = attrs.match(/\bsrc=["']([^"']+)["']/i)?.[1];
+            if (src) {
+                elements.push(_jsx("script", { src: src, async: /\basync\b/i.test(attrs) || undefined, defer: /\bdefer\b/i.test(attrs) || undefined, suppressHydrationWarning: true }, `${keyPrefix}-s-${index++}`));
+            }
+            else {
+                elements.push(_jsx("script", { dangerouslySetInnerHTML: { __html: content }, suppressHydrationWarning: true }, `${keyPrefix}-s-${index++}`));
+            }
+        }
+        lastIndex = tokenRe.lastIndex;
+    }
+    if (lastIndex < trimmed.length) {
+        const tail = trimmed.slice(lastIndex).trim();
+        if (tail)
+            pushHtmlFragment(elements, `${keyPrefix}-tail-${index++}`, tail);
+    }
+    if (elements.length === 0) {
+        elements.push(_jsx("script", { dangerouslySetInnerHTML: { __html: trimmed }, suppressHydrationWarning: true }, `${keyPrefix}-raw-0`));
+    }
+    return elements;
+}
+function pushHtmlFragment(out, key, html) {
+    out.push(_jsx("span", { dangerouslySetInnerHTML: { __html: html }, suppressHydrationWarning: true }, key));
+}
+export function ScriptTagGroup({ codes, idPrefix }) {
+    return (_jsx(Fragment, { children: codes.flatMap((code, i) => scriptTagCodeToElements(code, `${idPrefix}-${i}`)) }));
+}
+//# sourceMappingURL=script-tags.js.map

package/dist/next/script-tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-tags.js","sourceRoot":"","sources":["../../src/next/script-tags.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAqB,MAAM,OAAO,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,SAAiB;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAEvB,MAAM,QAAQ,GAAmB,EAAE,CAAA;IACnC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,MAAM,OAAO,GAAG,2EAA2E,CAAA;IAC3F,IAAI,KAA6B,CAAA;IAEjC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;YACzD,IAAI,IAAI;gBAAE,gBAAgB,CAAC,QAAQ,EAAE,GAAG,SAAS,SAAS,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC5E,CAAC;QAED,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CACX,mBAEE,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EACnD,wBAAwB,UAFnB,GAAG,SAAS,OAAO,KAAK,EAAE,EAAE,CAGjC,CACH,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACvD,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,IAAI,CACX,iBAEE,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,EAC5C,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,EAC5C,wBAAwB,UAJnB,GAAG,SAAS,MAAM,KAAK,EAAE,EAAE,CAKhC,CACH,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CACX,iBAEE,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAC5C,wBAAwB,UAFnB,GAAG,SAAS,MAAM,KAAK,EAAE,EAAE,CAGhC,CACH,CAAA;YACH,CAAC;QACH,CAAC;QAED,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAC/B,CAAC;IAED,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5C,IAAI,IAAI;YAAE,gBAAgB,CAAC,QAAQ,EAAE,GAAG,SAAS,SAAS,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,iBAEE,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAC5C,wBAAwB,UAFnB,GAAG,SAAS,QAAQ,CAGzB,CACH,CAAA;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB,EAAE,GAAW,EAAE,IAAY;IACtE,GAAG,CAAC,IAAI,CAAC,eAAgB,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,wBAAwB,UAAxE,GAAG,CAAwE,CAAC,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAyC;IACvF,OAAO,CACL,KAAC,QAAQ,cACN,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC,GACrE,CACZ,CAAA;AACH,CAAC"}

package/dist/next-site.d.ts

@@ -0,0 +1,29 @@
+import type { Metadata } from 'next';
+import { type ResolveResult, type SiteClientOptions } from './site.js';
+export interface NextSiteHelpersOptions extends SiteClientOptions {
+    /** ISR revalidate seconds in production (default 300). Dev uses request cache only. */
+    revalidate?: number;
+    /**
+     * When true (default), tag each path's ISR cache with `prenta:path:<path>` in
+     * addition to `prenta`, matching the CDN/SDK tag taxonomy from cms-core.
+     */
+    pathTags?: boolean;
+}
+/**
+ * Next.js site helpers for consumer `lib/cms.ts` files.
+ *
+ * - `resolveDocument` / `getNavigation` — deduped per request via `React.cache()`
+ * - `getCachedPublishedDocument` / `getCachedPageMetadata` — ISR-friendly wrappers
+ *   around the uncached `fetchDocument` (never wrap `resolveDocument` in `unstable_cache`)
+ */
+export declare function createNextSiteHelpers(options?: NextSiteHelpersOptions): {
+    client: import("./site.js").SiteClient;
+    getGlobal: <T = Record<string, unknown>>(slug: string) => Promise<T | null>;
+    fetchDocument: <T = Record<string, unknown>>(path: string, previewToken?: string) => Promise<ResolveResult<T> | null>;
+    resolveDocument: <T = Record<string, unknown>>(path: string, previewToken?: string) => Promise<ResolveResult<T> | null>;
+    getNavigation: (slug: string) => Promise<import("./site.js").PublicNavigation | null>;
+    getPublicForm: (slug: string) => Promise<import("./index.js").PublicForm | null>;
+    getCachedPageMetadata: (urlPath: string) => Promise<Metadata>;
+    getCachedPublishedDocument: <T = Record<string, unknown>>(urlPath: string) => Promise<ResolveResult<T> | null>;
+};
+//# sourceMappingURL=next-site.d.ts.map

package/dist/next-site.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-site.d.ts","sourceRoot":"","sources":["../src/next-site.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAEpC,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAExF,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAQD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B;;gBAerD,CAAC,kCAAkC,MAAM;oBAV/B,CAAC,kCAAkC,MAAM,iBAAiB,MAAM;sBAAhE,CAAC,kCAAkC,MAAM,iBAAiB,MAAM;0BAM1D,MAAM;0BAEN,MAAM;qCAMD,MAAM,KAAG,OAAO,CAAC,QAAQ,CAAC;iCAgB9B,CAAC,qCAAqC,MAAM;EAoBjF"}

package/dist/next-site.js

@@ -0,0 +1,60 @@
+import { cache } from 'react';
+import { unstable_cache } from 'next/cache.js';
+import { PRENTA_TAG_ROOT, prentaTag } from './cache/http.js';
+import { createSiteClient } from './site.js';
+function cacheTagsForPath(urlPath, pathTags) {
+    const tags = [PRENTA_TAG_ROOT];
+    if (pathTags)
+        tags.push(prentaTag('path', urlPath));
+    return tags;
+}
+/**
+ * Next.js site helpers for consumer `lib/cms.ts` files.
+ *
+ * - `resolveDocument` / `getNavigation` — deduped per request via `React.cache()`
+ * - `getCachedPublishedDocument` / `getCachedPageMetadata` — ISR-friendly wrappers
+ *   around the uncached `fetchDocument` (never wrap `resolveDocument` in `unstable_cache`)
+ */
+export function createNextSiteHelpers(options = {}) {
+    const { revalidate = 300, pathTags = true, ...clientOptions } = options;
+    const cms = createSiteClient(clientOptions);
+    const isDev = process.env.NODE_ENV === 'development';
+    async function fetchDocument(path, previewToken) {
+        return cms.resolveDocument(path, previewToken ? { previewToken } : undefined);
+    }
+    const resolveDocument = cache(fetchDocument);
+    const getNavigation = cache((slug) => cms.getNavigation(slug));
+    const getPublicForm = cache((slug) => cms.getPublicForm(slug));
+    function getGlobal(slug) {
+        return cms.getGlobal(slug);
+    }
+    function getCachedPageMetadata(urlPath) {
+        if (isDev) {
+            return resolveDocument(urlPath).then((result) => result?.metadata ?? {});
+        }
+        return unstable_cache(async () => {
+            const result = await fetchDocument(urlPath);
+            return result?.metadata ?? {};
+        }, ['page-metadata', urlPath], { revalidate, tags: cacheTagsForPath(urlPath, pathTags) })();
+    }
+    function getCachedPublishedDocument(urlPath) {
+        if (isDev) {
+            return resolveDocument(urlPath);
+        }
+        return unstable_cache(() => fetchDocument(urlPath), ['published-document', urlPath], {
+            revalidate,
+            tags: cacheTagsForPath(urlPath, pathTags),
+        })();
+    }
+    return {
+        client: cms,
+        getGlobal,
+        fetchDocument,
+        resolveDocument,
+        getNavigation,
+        getPublicForm,
+        getCachedPageMetadata,
+        getCachedPublishedDocument,
+    };
+}
+//# sourceMappingURL=next-site.js.map

package/dist/next-site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-site.js","sourceRoot":"","sources":["../src/next-site.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAA8C,MAAM,WAAW,CAAA;AAYxF,SAAS,gBAAgB,CAAC,OAAe,EAAE,QAAiB;IAC1D,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,EAAE,UAAU,GAAG,GAAG,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;IACvE,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAA;IAEpD,KAAK,UAAU,aAAa,CAA8B,IAAY,EAAE,YAAqB;QAC3F,OAAO,GAAG,CAAC,eAAe,CAAI,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;IAE5C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAEtE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAEtE,SAAS,SAAS,CAA8B,IAAY;QAC1D,OAAO,GAAG,CAAC,SAAS,CAAI,IAAI,CAAC,CAAA;IAC/B,CAAC;IAED,SAAS,qBAAqB,CAAC,OAAe;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAE,MAAM,EAAE,QAAiC,IAAI,EAAE,CAC7D,CAAA;QACH,CAAC;QACD,OAAO,cAAc,CACnB,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;YAC3C,OAAQ,MAAM,EAAE,QAAiC,IAAI,EAAE,CAAA;QACzD,CAAC,EACD,CAAC,eAAe,EAAE,OAAO,CAAC,EAC1B,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAC1D,EAAE,CAAA;IACL,CAAC;IAED,SAAS,0BAA0B,CAA8B,OAAe;QAC9E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,eAAe,CAAC,OAAO,CAAqC,CAAA;QACrE,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,OAAO,CAAC,EAAE;YACnF,UAAU;YACV,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1C,CAAC,EAAsC,CAAA;IAC1C,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,SAAS;QACT,aAAa;QACb,eAAe;QACf,aAAa;QACb,aAAa;QACb,qBAAqB;QACrB,0BAA0B;KAC3B,CAAA;AACH,CAAC"}

package/dist/next.d.ts

@@ -0,0 +1,33 @@
+import type { PrentaCMSConfig } from './config/types.js';
+/**
+ * Minimal CMS config accepted by withPrentaCMS.
+ * Only the fields actually used at build-time are required;
+ * consumers don't need to supply full CollectionDefinition objects.
+ */
+export interface WithPrentaCMSOptions {
+    admin?: {
+        path?: string;
+    };
+    collections?: Record<string, unknown>;
+    globals?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/**
+ * Loose Next.js config type that accepts any valid NextConfig properties.
+ * Avoids forcing consumers to cast their config objects.
+ */
+export interface NextConfigLike {
+    serverExternalPackages?: string[];
+    transpilePackages?: string[];
+    experimental?: unknown;
+    images?: unknown;
+    webpack?: unknown;
+    turbopack?: unknown;
+    env?: Record<string, string | undefined>;
+    headers?: unknown;
+}
+/** Wrap a Next.js configuration with Prenta CMS settings. */
+export declare function withPrentaCMS<T extends NextConfigLike>(cmsConfig: PrentaCMSConfig | WithPrentaCMSOptions, nextConfig?: T): T;
+/** Returns the configured admin path (reads from env at runtime). */
+export declare function getAdminPath(): string;
+//# sourceMappingURL=next.d.ts.map